PT-2026-33801 · Doorman · Doorman

Published

2026-04-20

·

Updated

2026-04-21

·

CVE-2026-30269

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions Doorman version 0.1.0 Doorman version 1.0.2
Description Improper access control allows any authenticated user to escalate their privileges to a non-admin privileged role. This occurs because the update model accepts the role field without performing a manage users permission check during self-updates via the '/platform/user/{username}' endpoint.
Recommendations For version 0.1.0, restrict the use of the role field in the '/platform/user/{username}' endpoint for self-updates. For version 1.0.2, restrict the use of the role field in the '/platform/user/{username}' endpoint for self-updates.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-30269

Affected Products

Doorman